Admin rights, upgrades and timelocks
Who can change the rules of a live position, how fast — and how much warning remains.
This lesson has had no expert review. It was written for this platform and against the evidence it cites; nobody has gone through it independently.
Learning objectives
- You can explain why “code is law” is incomplete for upgradeable contracts.
- You can translate a timelock into an operational reaction time.
Check your prior knowledge
Answer these for yourself before reading on. Wherever you hesitate is where this lesson pays off.
- What is a proxy contract?
- Who holds the keys to a multisig?
- What does an “emergency power” mean in a protocol?
Core concept
Upgradeable means: the code can become a different one
Many protocols sit behind a proxy: the address users interact with stays the same while the logic behind it can be swapped. That is not a weakness but the usual way to fix bugs. It does mean, though, that the audited code and the executed code can be two different things.
The timelock is the only figure that concerns you
Whether a change is good or bad is decided case by case. Operationally, a different number comes first: the time between decision and effect. It is the entire window in which to unwind an existing position on the old terms. Without a timelock that window is zero.
A missing field is an open question
This platform carries no field for admin rights or upgradeability, and most aggregators do not either. It does not follow that a protocol has none. The answer is in the protocol documentation and in chain state — until looked up there it is open, and should be recorded as open.
Definitions
- Proxy contract
- A contract that forwards calls to swappable logic.
- Timelock
- A fixed waiting period between a decision and a change taking effect.
- Multisig
- An address whose transactions require several signatures.
Model
Proposal submitted
Vote — quorum and vote distribution decide
Timelock runs — last opportunity to exit
Change takes effect, including for existing positions
Formulas
Remaining reaction time
Reaction time = timelock − time to notice − time to unwind- timelock
- period between decision and effect
- notice
- how long until the decision is noticed
- unwind
- how long closing the position actually takes
Limit: The calculation assumes the position can be unwound at all. At high utilization in a lending market, that may be exactly what does not hold.
Worked example
Forty-eight hours are not forty-eight hours
- Timelock
- 48 hours
- Decision noticed after
- 20 hours
- Unwinding the position takes
- 6 hours
48 − 20 − 6 = 22
22 hours of actual decision time.
Reading: The operationally relevant window depends on whether governance decisions are monitored at all. Without monitoring, even a long timelock has no effect.
Interactive model
The worked example, with movable figures. Estimate first what happens — then check.
Remaining reaction time
A timelock is only as long as what is left of it after noticing and unwinding.
Estimate first, then check
Before you move the sliders: how many hours of decision time remain if the timelock is 48 hours but the decision is noticed only after 30? And from what detection delay is the window closed?
The starting values are the worked example's own figures — change one input at a time.
Actual decision time: 22 h.
What the model does not show: The model assumes a fixed unwind duration. In a stressed market unwinding takes longer, and an emergency path without a timelock sets the window to zero — the bar shows neither.
Retrieval
Exercise on real data
Look up which factors enter this platform's flag points — and note that admin rights are not among them. That is a deliberately disclosed limit, not an omission.
Read this platform's methodology →Application
An organization holds a position in a protocol with upgradeable contracts. What operational process follows?
Related case studies
- CASE-14 — Where decision-making power sits
- CASE-03 — Governance changes a risk parameter
- CASE-09 — Audit present, question open
Institutional reading
- Bank
- Who inside the institution monitors governance decisions at the protocols used?
- Asset management
- Is the position's unwind duration shorter than the shortest timelock in the portfolio?
Metrics in this lesson
Key takeaways
- With upgradeable contracts, audited code and executed code can come apart.
- The timelock is the entire reaction time — and only effective if decisions are monitored.
Evidence
- EVD-2026-0004
Annual Review of Financial Economics — Smart Contracts and Decentralized Finance